Analysis
-
max time kernel
120s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
16/08/2023, 14:58
Static task
static1
Behavioral task
behavioral1
Sample
e3f7c8aac5a6b9fb5b88ea3a78c0761ac795aeb5d4d53f850242b85de3a05863.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
e3f7c8aac5a6b9fb5b88ea3a78c0761ac795aeb5d4d53f850242b85de3a05863.exe
Resource
win10v2004-20230703-en
General
-
Target
e3f7c8aac5a6b9fb5b88ea3a78c0761ac795aeb5d4d53f850242b85de3a05863.exe
-
Size
232KB
-
MD5
c16c222ea59c1c5645d4071a0615217f
-
SHA1
83e94c1bec93dce47a144bfdfb63020a1291980e
-
SHA256
e3f7c8aac5a6b9fb5b88ea3a78c0761ac795aeb5d4d53f850242b85de3a05863
-
SHA512
4de85e3c0b1476876596caf3e5be192755472bf09ea00d6d18ca8e1aa74ba4eb46c6080a25c7568b8cab208fb18f1ce6b8ee300005987d3ffc2ff7fbb739434b
-
SSDEEP
6144:77kRWMAXbegF97VqAKSFDv5wEpBNURJMHvNVdAwWNY+:74f6bew7Q4DR//NU8PNVdCN
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1964-56-0x00000000001D0000-0x0000000000207000-memory.dmp upx behavioral1/memory/1964-59-0x00000000001D0000-0x0000000000207000-memory.dmp upx behavioral1/memory/1964-69-0x00000000001D0000-0x0000000000207000-memory.dmp upx behavioral1/memory/1964-70-0x0000000180000000-0x0000000180032000-memory.dmp upx behavioral1/memory/1964-74-0x0000000180000000-0x0000000180032000-memory.dmp upx behavioral1/memory/1964-75-0x0000000180000000-0x0000000180032000-memory.dmp upx behavioral1/memory/1964-76-0x00000000001D0000-0x0000000000207000-memory.dmp upx -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeBackupPrivilege 1964 e3f7c8aac5a6b9fb5b88ea3a78c0761ac795aeb5d4d53f850242b85de3a05863.exe Token: SeSecurityPrivilege 1964 e3f7c8aac5a6b9fb5b88ea3a78c0761ac795aeb5d4d53f850242b85de3a05863.exe